AI and Subject Access Requests

Subject Access Requests (SARs) are one of the toughest parts of GDPR compliance. They’re also one of the most common — and most time-consuming — rights organisations people exercise. A client recently asked me if we can use AI to help manage SARs.

That’s a complex question. As an experienced Data Protection Officer I don’t want to be automated away. But the full answer goes further than that.

Can AI really help with SARs?

The short answer: AI can speed up some legwork, but it can’t yet handle the judgment, context, and legal nuance that SARs demand.

What’s Involved in a Subject Access Request?

When an individual makes an SAR, organisations have just one month (or up to three in complex cases) to deliver. That means:

• Finding the data
• Collating it into a usable format
• Reviewing the information
• Working out what must be excluded (e.g. confidential references)
• Deciding what should be redacted (e.g. personal data of third parties)
• Explaining the background (lawful basis for processing, retention policies, etc.)
• Sending it all to the requestor, securely and on time

For most teams, this is a significant administrative burden — and often stressful. Imagine if AI could take that pain away.

• Read our detailed guide to responding to subject access requests here.

Where AI Could Help

AI is good at certain repeatable, data-heavy tasks. In theory, it could:

• Search for data using identifiers like name, email, job title, or reference number
• Collate basic summaries or tables of results
• Flag potential documents for review

These functions could shave hours off the early stages of an SAR.

Why AI Falls Short

So why can’t AI take SARs off your plate entirely? Because SARs are about judgment and context, not just data retrieval. Some of the challenges include:

1. People. Policies say “delete old data” — but people often don’t. AI can’t always predict human inconsistency.
2. Data quality. Records are frequently incomplete, duplicated, or stored in odd places with version control issues.
3. Context. Identifying personal data isn’t always about obvious fields. “She’s made 15 complaints this month” might identify the requestor — or someone else. Humans spot these nuances; AI struggles.
4. Risk. Some disclosures need specialist review (HR, legal, clinical). AI can’t replace professional judgment here.
5. Legal limits. Using AI in SARs may raise its own GDPR concerns — especially around automated processing and decision-making rights.

In short: AI helps with volume, not with nuance.

What Would It Take for AI to Handle SARs?

For AI to truly manage SARs end-to-end, it would need:

• The ability to interpret messy human behaviour (like breaking policies).
• Integration into the entire data lifecycle — from collection to deletion — not just when a request lands.
• Clear transparency in privacy notices and policies about when and how AI is used with personal data.

In other words, an AI that could disobey rules or creatively rewrite them. That’s useful for finding lost data — but far less desirable in safety-critical environments like air traffic control or healthcare.

Conclusion

AI can assist with the legwork of subject access requests, but it can’t (yet) do the heavy lifting: context, judgment, and legal reasoning. For now, organisations still need trained people to handle SARs properly.